Let \(\mathsf {ClawFree} = (\mathsf {TCF.}\mathsf {Gen}, \mathsf {Eval}, \mathsf {Invert}, \mathsf {Check}, \mathsf {Good})\)  denote a family of [1]} randomized TCFs (def:clawfree). For simplicity of the analysis, we assume that on a fixed security parameter \(1^\lambda \) , \(\mathsf {Gen}\)  outputs keys defining functions from \(\lbrace 0,1\rbrace  \times D\)  to \(R\) , where \(D\)  is a fixed-size subset of \(\lbrace 0,1\rbrace ^{\ell (\lambda )}\)  independent of \(\mathsf {pk}\) .The LWE-based instantiation from [2]} satisfies this property. However, with more complicated expressions, our proof should go through without this simplifying assumption. We denote the size of \(D\)  by \(L(\lambda )\) . Let \((\mathsf {Gen}, \mathsf {ExtPk}, \mathsf {ExtSk})\)  denote a batch key generation algorithm for \(\mathsf {TCF}.\mathsf {Gen}\)  satisfying the requirements described above.
